CVE-2024-9672

6.3 mediumEPSS 0.2%

Medium (6.3) in papercut. EPSS 0.2% chance of exploitation in the next 30 days.

A reflected cross-site scripting (XSS) vulnerability exists in PaperCut NG/MF. This issue can be used to execute specially created JavaScript payloads in the browser. A user must click on a malicious link for this issue to occur.

Severity

CVSS 4.0

6.3 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:H/SI:H/SA:N

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 14% of CVEs (scores of 2026-10-31)
CWEs: CWE-79, CWE-917
Published: 2024-12-10
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

papercut:papercut_mf
papercut:papercut_ng

References

https://www.papercut.com/kb/Main/security-bulletin-december-2024/

Check your stack JSON